CVE-2026-84934: JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override

Q: Which accounts can trigger the issue?

Any authenticated WordPress user, including a Subscriber, can trigger it. Administrative privileges are not required because the affected AJAX action lacks a capability check.

Q: Who can be affected after exploitation?

The stored script can execute in the browser of any visitor or administrator who views the site.

Q: Which installations require remediation?

Sites using the JCH Optimize WordPress plugin before version 6.0.1 are affected.

Published Sep 5, 2026

Updated

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.

Affected Software

1 affected component

JCH Optimize WordPress plugin<6.0.1

Event History

Sep 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which accounts can trigger the issue?

Any authenticated WordPress user, including a Subscriber, can trigger it. Administrative privileges are not required because the affected AJAX action lacks a capability check.

Who can be affected after exploitation?

The stored script can execute in the browser of any visitor or administrator who views the site.

Which installations require remediation?

Sites using the JCH Optimize WordPress plugin before version 6.0.1 are affected.